ITP Techblog

Brought to you by IT Professionals NZ
Menu
« Back to Legal

Digital Identity in New Zealand: technical choices have human impacts

By James Ting-Edwards, Contributor. 26 November 2021, 9:35 am

From 11:59pm on 2 December, New Zealand will shift into the COVID Protection Framework, also known as the traffic light system.

A key part of this system is the government's My Vaccine Pass app, which supports more venues and activities to open up safely, by giving a way to check that everyone is vaccinated. At the time of writing, over a million digital vaccine passes had been created.

For the people using them, this is likely to be their first experience with a digital identity system, something that we think will be much more common over the next decade. The basic idea of digital identity is to offer a digital alternative to physical identity documents like a drivers' licence, a passport, or a gym membership card. These ID documents answer practical questions like who can buy alcohol, who can board an international flight, and who gets access to the fancy rowing machines.

Beyond replacing paper and plastic ID documents, digital identity systems open up new ways to share details about ourselves and check information about other people. We think this change in technology will raise some big social questions and consequences. Questions of how we identify ourselves and others are fundamental to social life. So it's vital that the design, use, and regulation of digital identity systems draws on diverse perspectives across society. On other days we might say that just as a value statement, but right now we are making a very practical point about a very real problem.

On the same day we start using My Vaccine Pass, submissions close on a draft law that will be vital for the future of digital identity systems in New Zealand.
Parliament's Economic Development, Science and Innovation Committee is currently taking submissions on the Digital Identity Systems Trust Framework Bill.
This Bill will set legal rules for digital identity systems in New Zealand, and as the name suggests, trust is at the heart of the framework.

Too much, too soon?

The problem is that new relationships of trust are needed, and we are not sure that enough time and attention has gone into building them. The idea of digital identity is really interesting to organisations that gather and use lots of information about people, like official government registries or businesses like banks. But most of us, the people who all this information is about, have not really had a chance to engage on the good, bad, and ugly issues around digital identity.

As the response to the COVID-19 pandemic shows, one-size-fits-most approaches are not enough to fully include and build trust with everyone in New Zealand. Some people and communities have good reasons not to automatically trust in systems. Reaching these people and earning their trust can require different approaches, like the Super Saturday vaxathon event which highlighted how working from relationships of trust can really help to engage a lot more people with diverse positions in life.

We think digital identity raises some particularly tough challenges for building trust in shared systems. Long-standing gaps on digital equity mean that any digital system default can make full participation in society even harder. There are also big challenges with how systems treat identity. Our identity can relate to deeply personal issues of who we are and our place in the world, and it can change over time. If systems are not carefully designed to navigate these issues, they can force people into pre-set categories and cause serious problems. This is not theoretical.

Overseas, broad adoption of digital identity systems has had terrible consequences for human rights and public participation. For example, reporting suggested digital identity data held by the ousted government of Afghanistan would put the security of public servants at risk when it came under the control of the Taliban.

In New Zealand, the approach taken to rolling out My Vaccine Pass provides a local example of how a digital identity system can potentially harm and exclude people. Using My Vaccine Pass will be essential to access a wide variety of activities and venues. To get set up online, people need to have an existing RealMe account, or link their pass to a New Zealand drivers licence or passport. They also need a unique email address. These might be reasonable design decisions in some ways, but they also affect who can easily access the pass. Gaps in digital equity will be further widened by relying on a digital system that you need to go online to know about and set up.

Design choices have human impacts

Households where people share an email address, and adults or kids who do not have their own email accounts will find it harder. So will people who do not have New Zealand identity documents. There is an 0800 support number (0800 222 478), and a plan for drop-in sessions, but it is not clear these
will solve the access issues for a system most people will need in daily life. There are also some technical design choices that will harm and exclude people.
Even if someone has a drivers licence or passport, the information on these documents can be inaccurate and hard to change in ways that are demeaning and
exclusionary. People who go by a name that's not on their ID, including people with an official name that English speakers often mangle, won't have this on their pass.

Media coverage has also highlighted the potential for passes to be extremely offensive and re-traumatising when they deadname or misgender transgender and
nonbinary people, referring to old information on photo IDs that do not match a person's identity. These design choices have human impacts. The problem is that the people impacted were not in the conversation about which design choices to make. Even working at speed, and knowing that there are some trade-offs, and that some people are harder to reach than others, the process here missed a key step. It did not involve broad community input at early design stages.

We think it is imperative to avoid the same mistakes as we make rules for the future of digital identity in New Zealand. You can help with that by making a
submission to the Select Committee process, and encouraging others to as well.

You can read our explainer on submissions here: Have your say: digital identity for Aotearoa.

InternetNZ will be submitting. We agree that digital identity rules need to focus on building trust with everyone, as the right foundation for innovation that benefits everyone. One idea to do that is to make the rules mandatory like financial regulations, rather than letting service providers opt in or opt out. Another is to build a system that prioritises and resources engagement with diverse communities, including the people most likely to be harmed. We think that is the
way to build a trust framework that deserves the name.

James Ting-Edwards is Senior Policy Advisor at InternetNZ


Comments

You must be logged in in order to post comments. Log In

David Lane 26 November 2021, 3:53 pm

I have no confidence in our gov't to make any sensible decisions about this. For one thing, it shouldn't be privatised. It needs to be gov't (i.e. the People of Aotearoa NZ)-owned and fully open source to have any hope of being trustworthy.

I'm still appalled that I had to agree - in order to be compliant with the coming My Vaccine Passport requirements - to having my medical data, held by the NZ gov't, outside the NZ jurisdiction in Australia, in the Cloud a US-owned multinational (subject to the US Patriot and Cloud Acts) rather onshore here in NZ. Why haven't we seen any push back from ITP & InternetNZ folk about that total blunder? We've failed at any hope of a trustworthy, inclusive identity model for Aotearoa NZ before we've even started.


Web Development by The Logic Studio